CVE-2026-124194: listed in the CISA KEV catalog
CVE-2026-124194 · CVSS 6.5 MEDIUM · KEV 2026-11-10 · patch available
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Is CVE-2026-124194 exploited?
- Listed in the CISA KEV catalog on 2026-11-10.
- Federal remediation due 2026-11-24.
- Public exploit code: none found in monitored sources.
Which products and versions are affected?
- Microsoft · Microsoft 365 Apps for Enterprise · >= 16.0.1, < https://aka.ms/OfficeSecurityReleases
- Microsoft · Microsoft Office LTSC 2021 · >= 16.0.1, < 16.0.14334.21048
- Microsoft · Microsoft Office LTSC 2024 · >= 16.0.0, < 16.0.17932.21140
- Microsoft · Microsoft Office LTSC 2021 for 32-bit editions
- Microsoft · Microsoft Office LTSC 2021 for 64-bit editions
Is there a patch?
Yes. Update to one of these or later:
| Microsoft Office LTSC 2021 16.0.1 | 16.0.14334.21048 |
|---|
| Microsoft Office LTSC 2024 16.0.0 | 16.0.17932.21140 |
|---|
From Microsoft's CVE record · Microsoft advisory
| Microsoft Office LTSC 2021 for 32-bit editions | 16.0.14334.21048 |
|---|
| Microsoft Office LTSC 2021 for 64-bit editions | 16.0.14334.21048 |
|---|
From Microsoft's Security Update Guide · Microsoft advisory
What PlainSec published about CVE-2026-124194
Primary sources
What this record does not say
KEV and EPSS are re-checked daily. Record last updated 2026-11-13.